I have splunk forwarder setup to forward cloudfront logs on S3, say following is the example of raw logs:
2015-01-15 20:59:36 LHR50 334 22.214.171.124 GET zfu.cloudfront.net
Can someone give me an example how to map them to key=value pairs? so I can query them in splunk
I suggest using the field extractor. If you are running 6.2.x this feature has improved greatly. Have a look here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ExtractfieldsinteractivelywithIFX
You can extract fields using props/transoforms but for simple extractions the Interactive Field Extractor works great.
Thanks for the reply, I was trying to do it as how explained below
Cloudfront format is as following
I tried steps mentioned in link above but still doesn't work, do I need to change prop.conf for this?